CVE-2023-27489 json
Stored cross site scripting via SVG file upload in Kiwi TCMS
published 2023-03-29 3 y ago modified 2026-09-10 1 mo ago also GHSA-2wcr-87wf-cf9j , PYSEC-2026-1496 , EUVD-2023-0835
- cvss
- 7.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 42%
- public exploits
- 0
- none known
Summary
Kiwi TCMS is an open source test management system for both manual and automated testing. Kiwi TCMS accepts SVG files uploaded by users which could potentially contain JavaScript code. If SVG images are viewed directly, i.e. not rendered in an HTML page, this JavaScript code could execute. This vulnerability has been fixed by configuring Kiwi TCMS to serve with the Content-Security-Policy HTTP header which blocks inline JavaScript in all modern browsers. This configuration change is provided in version 12.1 and users are advised to upgrade. Users unable to upgrade may set their Content-Security-Policy HTTP header manually.
Patch / fix
- pypi kiwitcms 12.1
- kiwitcms kiwi_tcms 12.1
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 20 mo ago
Exploit prediction
0.48% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 7.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L |
| OSV | 3.1 | 7.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | kiwitcms | <12.1 |
12.1 |
Affected products
- kiwitcms Kiwi
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/kiwitcms/Kiwi/commit/6617cee0fb70cc394b7be6bbc86ef84e6e9de077
web, patch
-
github.com
/kiwitcms/Kiwi/security/advisories/GHSA-2wcr-87wf-cf9j
web, patch, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-27489
advisory
-
github.com
/kiwitcms/Kiwi
package
-
pypi.org
/project/kiwitcms
package
-
github.com
/advisories/GHSA-2wcr-87wf-cf9j
advisory
Sources
- CVE List CVE-2023-27489
- GitHub Advisory GHSA-2wcr-87wf-cf9j
- NVD CVE-2023-27489
- OSV PYSEC-2026-1496
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.